pac-resolver

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance despite a recent package release.

Repo package mentioncaution

The linked repository name does not match pac-resolver and its README does not mention the package, so the repository-to-package relationship is less transparent.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting procedures unclear. This is a transparency gap, not evidence that the release is unsafe.

Workflow auditcaution

All 13 analyzed action references are unpinned, and the release workflow installs a package outside a lockfile. The cache-poisoning findings are low confidence and are hygiene concerns rather than standalone severe risks.